EUVD-2026-74799
GHSA-pvq3-8vp3-rhh8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSRF exfiltrates secrets only (C:H); no described integrity or availability impact; PR:L reflects required authentication and ai_generate_text() execute privilege.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the ai_generate_text() function to exfiltrate secrets stored in Hadoop Credential Providers configured via hadoop.security.credential.provider.path in core-site.xml. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all five of the following: (1) the target cluster runs Apache Impala 4.4.0 through 4.5.1; (2) the attacker holds a valid authenticated Impala account; (3) that account has been granted EXECUTE privilege on the `ai_generate_text()` built-in function; (4) the cluster is configured with at least one Hadoop Credential Provider via `hadoop.security.credential.provider.path` in `core-site.xml`; and (5) the attacker knows the alias or key name of a target secret in that provider. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 8.8 with C:H/I:H/A:H overstates the impact: the described vulnerability is a credential-exfiltration SSRF whose confirmed impact is confidentiality, not integrity or availability modification, making I:H and A:H unsupported by the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No explicit fixed version is confirmed in the available advisory data; administrators should monitor the Apache Impala project page (https://impala.apache.org/) and the oss-security thread (https://lists.apache.org/thread/nnk4660cbs6dmmkch7ch7wwb3g9myw7j) for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all deployed Impala 4.4.x and 4.5.x instances and audit which users hold execute permissions on the ai_generate_text() function. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 coul
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of
In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. Rated critical severity (CVSS 9.
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-stor
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent
Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. Rated high severi
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can i
In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any
Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to injec
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala dae
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today